The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from web searches and the .local/ directory to generate skill instructions.
Ingestion points: Data is gathered from recursive reads of the .local/ directory (Step 2) and results from external web searches.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' markers when interpolating gathered data into the drafted SKILL.md or scripts.
Capability inventory: The skill has the ability to write new files to the skills/ directory (including executable scripts) and execute the make check command.
Sanitization: While it mandates manual verification and cross-validation of facts, it lacks automated sanitization or escaping mechanisms for the ingested data.
[COMMAND_EXECUTION]: The workflow requires executing the make check command (Step 5) to validate the authored skill, which involves running local shell processes.
[EXTERNAL_DOWNLOADS]: The skill is instructed to perform web searches for research purposes, which involves interacting with external network resources and ingesting data from arbitrary third-party domains.

add-skill